aizome launches AI Compliance Posture - continuous compliance tracking across OWASP, MITRE ATLAS, ARMCF, AI RMF, and the EU AI Act, built directly into the platform that governs your agents. - By aizome
The board question has been coming for two years. Most organizations have prepared for it with documents, policies, and frameworks describing what good AI governance should look like.
What they have not had is a number. Today, aizome changes that.
Introducing AI Compliance Posture
AI Compliance Posture is a new module inside the aizome platform that gives CIOs, CISOs, GRC leaders, and AI governance teams a continuously updated compliance score across the frameworks that matter most for enterprise AI agent deployment.
Out of the box: OWASP Top 10 for LLMs, MITRE ATLAS, ARMCF, NIST AI RMF, and the EU AI Act.
Not a point-in-time audit. Not a spreadsheet of controls mapped to frameworks. A live posture score - with the specific gaps identified and the remediation actions built directly into the platform - updated as your agent population changes, as policies are applied, and as the regulatory landscape shifts.
One important note on scope: AI Compliance Posture scores the controls within each framework that are directly relevant to AI agent identity, runtime behavior, and governance infrastructure - the dimensions aizome is built to enforce. Each framework contains additional requirements across data governance, human oversight processes, transparency obligations, and organizational risk management. The score reflects your posture on the agent governance controls. It is a critical part of your compliance picture. It is not the whole picture. Your broader GRC program owns the rest.
The score your board is about to ask for - for this part of the picture - it now exists.
What the AI Compliance Posture module does:
It shows you where you actually stand - and what is driving the gap.The compliance dashboard surfaces your overall posture score and breaks it down by framework. If your OWASP Top 10 coverage is at 87% and your EU AI Act score on agent governance controls is at 21%, you see both, and you see why. Non-compliant controls surface automatically, tagged to the specific framework articles they map to. The gap is not hidden in an audit report. It is on the screen, in red, the moment you open the module, alongside the specific actions needed to close it.
It recommends the actions that close the gap, and executes them inside the platform.Suggested actions are generated directly from your current compliance gaps, tagged to the frameworks they address, and executable without leaving aizome. Setting an intent drift policy to close an EU AI Act gap does not require a separate tool, a separate workflow, or a ticket to another team. You set the policy, the control is implemented, and the score updates. The remediation path is built in from day one, not surfaced after you’ve already found the problem.
It shows you the change in real time.When two policies - an intent drift policy and a dynamic role with JIT access - close the EU AI Act gap from critical to resolved, the score moves immediately. The board question has an answer. The answer is current. The evidence trail is already there.
The EU AI Act Is Enforced. 21% Is Not a Passing Score.
The EU AI Act’s high-risk provisions are now enforceable. For most enterprises deploying AI agents that touch employee data, financial systems, HR records, or customer information, whether those agents qualify as high-risk under the Act is no longer theoretical.
21% is where most enterprises start when they run their first AI Act compliance assessment against their actual agent population - not their approved list, not their documented policies, but what is actually running and what controls are actually in place.
To be precise about what that number represents: 21% reflects coverage of the agent-specific controls within the EU AI Act - requirements around intent monitoring, access scoping, human oversight documentation, and audit trail completeness. These are the controls that live at the infrastructure layer. They are also the controls that most enterprises have not yet implemented, because no tool in their existing stack was built to enforce them.
The gap is not a policy gap. It is an infrastructure gap. The controls the EU AI Act requires at the agent governance layer - intent drift detection, dynamic role scoping, data sensitivity enforcement, documented human oversight - are not things a governance document provides. They are things a platform enforces.
aizome enforces them. And now it scores them.
The Governance Layer That Was Missing
Every GRC program in the enterprise has a compliance posture view for its traditional risk surface. Vulnerability scores. Policy compliance rates. Audit findings. CISOs walk into board meetings with dashboards that show coverage and gaps across the security program.
AI agents have been largely outside that view. Not because GRC teams weren’t paying attention.
Because the infrastructure to generate a meaningful score for this class of actor did not exist.
AI agents introduce a risk surface that existing tools were not designed to score. Their risk is not only in the vulnerabilities they may expose - it is behavioral. It lives in what they do, how their behavior shifts over time, what instructions they were given and by whom, and whether the gap between what they were permitted and intended to do and what they are actually doing is widening.
That is exactly the surface aizome governs. And it is exactly the surface AI Compliance Posture scores.
For the CIO who needs to answer the board on agent governance. For the CISO who needs to integrate AI agent risk into the enterprise risk program. For the GRC leader who needs a framework-mapped posture view - scoped to agent controls, but mapped to the frameworks your auditors already use - that updates as the environment changes. For the CAIO who needs to show that AI deployment is happening inside a governed program, not alongside one.
The score exists. The evidence trail exists. The remediation path is built in. And your broader compliance program now has the one layer it was missing.
Come see it in action at hands-on demo.
aizome is the Enterprise AI Agent Control Platform and a founding player in the ARISE - Agentic Runtime Identity Security Enforcement - category, recognized by the Gartner Emerging Technologies Impact Report on AI Security.
aizome
The latest news, technologies, and resources from our team.
Something is shifting in how enterprises evaluate AI agent security vendors. Twelve months ago, the conversations were broad. What do you cover? What does the dashboard look like? Can you show me a demo? Now the questions are specific. And the vendors that cannot answer them are getting cut from the shortlist faster than anyone expected.
aizome
Your Finance team built an AI agent last Tuesday. It is connected to SAP. HR has one connected to Workday. Sales built three connected to Salesforce. None of them went through IT. None of them have a governed identity. And nobody is watching what they are actually doing. This is a CIO problem. Because when the board asks - which AI agents are connected to our critical systems, what are they costing us, and who is accountable - the answer has to come from you. Most CIOs cannot answer those questions today. Not because they are not paying attention. Because the infrastructure to answer them does not exist in their current stack.
aizome
Someone walked up to our booth and asked: “So what do you do - is this like a guardrails thing?” It is a reasonable question. Most of what people have heard about AI security has been about guardrails - content filters, output moderation, prompt sanitization. The assumption baked into that question is that the risk lives at the language layer. That assumption is no longer the right one. And the gap between where most people think the risk is and where it actually is - that is where the incidents are happening.
Amir Ofek
The conversation about AI agent security has been dominated by the wrong question. For the last two years, most of the energy in this space has gone into making AI agents say the right things. Guardrails. Output filters. Prompt sanitization. The implicit assumption is that the risk lives at the language layer. That assumption is now definitively wrong. The problem has moved from prompt hygiene to access architecture. The risk is not what agents say. It is what they do - with authorized access, through legitimate tool calls, in ways that no output filter was designed to evaluate.
Chen Pipek
Support teams do something no other department does on purpose. They let strangers write directly into their systems. Customers paste logs, forward email threads, attach files, and describe problems in whatever words they have. An AI agent can turn that pile into a clean morning queue summary. It can also read it as instructions. We built a complete indirect prompt-injection chain using Salesforce and Claude Desktop. An outsider filed a plausible billing ticket through a public support form. Later, an employee asked Claude to summarize the day’s queue. Claude read the ticket, followed a short routing block buried inside it, exported 25 Accounts, 25 Contacts, and 25 Cases, and mailed the package to an external address.
aizome Research Labs
SACR named ARISE. Every vendor will now claim it. Six capabilities separate genuine ARISE platforms from adjacent tools with a new label - and six evaluation questions that tell you which one you are looking at before you buy.
Chen Pipek
Occasional, substance-first notes on making enterprise AI agents accountable. No spam; unsubscribe anytime.
